@sovovs/bycli 1.8.0 → 2.1.0

package/dist/src/browser/verify-fixture.js

@@ -28,8 +28,8 @@
  *   }
  */
 import * as fs from 'node:fs';
-import * as os from 'node:os';
 import * as path from 'node:path';
+import { getSitesDir } from '../config-paths.js';
 const DEFAULT_MAX_TOP_LEVEL_KEYS = 12;
 const DEFAULT_MAX_NESTED_DEPTH = 1;
 const ID_SHAPED_KEY_PATTERNS = [
@@ -51,7 +51,7 @@ const ID_SHAPED_KEY_PATTERNS = [
     /^uri$/i,
 ];
 export function fixturePath(site, command) {
-    return path.join(os.homedir(), '.bycli', 'sites', site, 'verify', `${command}.json`);
+    return path.join(getSitesDir(), site, 'verify', `${command}.json`);
 }
 export function loadFixture(site, command) {
     const p = fixturePath(site, command);

package/dist/src/build-manifest.js

@@ -28,6 +28,7 @@ import { getErrorMessage } from './errors.js';
 import { fullName, getRegistry } from './registry.js';
 import { findPackageRoot, getCliManifestPath } from './package-paths.js';
 import { isRecord } from './utils.js';
+import { canonicalizeManifestArgSchema } from './manifest-schema.js';
 const PACKAGE_ROOT = findPackageRoot(fileURLToPath(import.meta.url));
 const CLIS_DIR = path.join(PACKAGE_ROOT, 'clis');
 // Write manifest next to clis/ so both dev and installed runtime can find it.
@@ -58,7 +59,7 @@ function toManifestArgs(args) {
     return args.map(arg => ({
         name: arg.name,
         type: arg.type ?? 'str',
-        default: arg.default,
+        ...(Object.prototype.hasOwnProperty.call(arg, 'default') ? { default: arg.default } : {}),
         required: !!arg.required,
         valueRequired: !!arg.valueRequired || undefined,
         positional: arg.positional || undefined,
@@ -85,6 +86,7 @@ function isCliCommandValue(value, site) {
         && Array.isArray(value.args);
 }
 function toManifestEntry(cmd, modulePath, sourceFile) {
+    canonicalizeManifestArgSchema(cmd.args, `Command ${fullName(cmd)}`);
     return {
         site: cmd.site,
         name: cmd.name,
@@ -94,7 +96,7 @@ function toManifestEntry(cmd, modulePath, sourceFile) {
         example: cmd.example,
         domain: cmd.domain,
         strategy: (cmd.strategy ?? 'public').toString().toLowerCase(),
-        browser: cmd.browser ?? true,
+        browser: cmd.browser,
         args: toManifestArgs(cmd.args),
         columns: cmd.columns,
         defaultFormat: cmd.defaultFormat,

package/dist/src/capabilityRouting.d.ts

@@ -1,4 +1,4 @@
-import type { CliCommand } from './registry.js';
+import type { BrowserCliCommand, CliCommand, NonBrowserCliCommand } from './registry.js';
 /**
  * Pipeline steps that require a live browser session.
  *
@@ -16,4 +16,5 @@ export declare const BROWSER_ONLY_STEPS: Set<string>;
 export declare function _validateBrowserOnlyStepsAgainstRegistry(): {
     extras: string[];
 };
-export declare function shouldUseBrowserSession(cmd: CliCommand): boolean;
+export declare function shouldUseBrowserSession(cmd: BrowserCliCommand | NonBrowserCliCommand): boolean;
+export declare function shouldUseBrowserSession(cmd: CliCommand, resolvedBrowser: boolean): boolean;

package/dist/src/capabilityRouting.js

@@ -1,3 +1,4 @@
+import { CommandExecutionError } from './errors.js';
 import { getRegisteredStepNames } from './pipeline/registry.js';
 /**
  * Pipeline steps that require a live browser session.
@@ -40,8 +41,15 @@ function pipelineNeedsBrowserSession(pipeline) {
         return Object.keys(step).some((op) => BROWSER_ONLY_STEPS.has(op));
     });
 }
-export function shouldUseBrowserSession(cmd) {
-    if (!cmd.browser)
+export function shouldUseBrowserSession(cmd, resolvedBrowser) {
+    let browserRequired = resolvedBrowser;
+    if (browserRequired === undefined) {
+        if (cmd.browser === 'conditional') {
+            throw new CommandExecutionError(`Conditional browser requirement for ${cmd.site}/${cmd.name} must be resolved before capability routing`);
+        }
+        browserRequired = cmd.browser;
+    }
+    if (!browserRequired)
         return false;
     if (cmd.func)
         return true;

package/dist/src/cli.js

@@ -8,6 +8,7 @@ import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import { getUserClisDir, getSitesDir } from './config-paths.js';
 import { Command, InvalidArgumentError, Option } from 'commander';
 import { findPackageRoot, getBuiltEntryCandidates } from './package-paths.js';
 import { fullName, getRegistry, strategyLabel } from './registry.js';
@@ -148,7 +149,7 @@ function emitNetworkError(code, message, extra = {}) {
     process.exitCode = NETWORK_ERROR_EXIT[code] ?? EXIT_CODES.GENERIC_ERROR;
 }
 export function checkSiteMemory(site) {
-    const siteDir = path.join(os.homedir(), '.bycli', 'sites', site);
+    const siteDir = path.join(getSitesDir(), site);
     const endpointsPath = path.join(siteDir, 'endpoints.json');
     const notesPath = path.join(siteDir, 'notes.md');
     let endpointsCount = 0;
@@ -505,7 +506,7 @@ export function createProgram(BUILTIN_CLIS, USER_CLIS) {
                     description: c.description,
                     access: c.access,
                     strategy: strategyLabel(c),
-                    browser: !!c.browser,
+                    browser: c.browser,
                     args: formatArgSummary(c.args),
                 }));
             renderOutput(rows, {
@@ -2357,10 +2358,9 @@ Examples:
                 process.exitCode = EXIT_CODES.USAGE_ERROR;
                 return;
             }
-            const os = await import('node:os');
             const fs = await import('node:fs');
             const path = await import('node:path');
-            const dir = path.join(os.homedir(), '.bycli', 'clis', site);
+            const dir = path.join(getUserClisDir(), site);
             const filePath = path.join(dir, `${command}.js`);
             if (fs.existsSync(filePath)) {
                 console.log(`Adapter already exists: ${filePath}`);
@@ -2427,7 +2427,7 @@ cli({
             }
             const { execFileSync } = await import('node:child_process');
             const { loadFixture, writeFixture, deriveFixture, validateRows, validateRowShape, fixturePath, expandFixtureArgs, parseSeedArgs } = await import('./browser/verify-fixture.js');
-            const filePath = path.join(os.homedir(), '.bycli', 'clis', site, `${command}.js`);
+            const filePath = path.join(getUserClisDir(), site, `${command}.js`);
             if (!fs.existsSync(filePath)) {
                 console.error(`Adapter not found: ${filePath}`);
                 console.error(`Run "bycli browser init ${name}" to create it.`);
@@ -2773,8 +2773,7 @@ cli({
         .command('status')
         .description('Show which sites have local overrides vs using official baseline')
         .action(async () => {
-        const os = await import('node:os');
-        const userClisDir = path.join(os.homedir(), '.bycli', 'clis');
+        const userClisDir = getUserClisDir();
         const builtinClisDir = BUILTIN_CLIS;
         try {
             const userEntries = await fs.promises.readdir(userClisDir, { withFileTypes: true });
@@ -2789,7 +2788,7 @@ cli({
                 console.log('No local adapter overrides. All sites use the official baseline.');
                 return;
             }
-            console.log(`Local overrides in ~/.bycli/clis/ (${userSites.length} sites):\n`);
+            console.log(`Local overrides in ${userClisDir} (${userSites.length} sites):\n`);
             for (const site of userSites) {
                 const isOfficial = builtinSites.includes(site);
                 const label = isOfficial ? 'override' : 'custom';
@@ -2806,8 +2805,7 @@ cli({
         .description('Copy an official adapter to ~/.bycli/clis/ for local editing')
         .argument('<site>', 'Site name (e.g. twitter, bilibili)')
         .action(async (site) => {
-        const os = await import('node:os');
-        const userClisDir = path.join(os.homedir(), '.bycli', 'clis');
+        const userClisDir = getUserClisDir();
         const builtinSiteDir = path.join(BUILTIN_CLIS, site);
         const userSiteDir = path.join(userClisDir, site);
         try {
@@ -2820,13 +2818,13 @@ cli({
         }
         try {
             await fs.promises.access(userSiteDir);
-            console.error(`Site "${site}" already exists in ~/.bycli/clis/. Use "bycli adapter reset ${site}" first to restore official version.`);
+            console.error(`Site "${site}" already exists in ${userClisDir}. Use "bycli adapter reset ${site}" first to restore official version.`);
             process.exitCode = EXIT_CODES.USAGE_ERROR;
             return;
         }
         catch { /* good, doesn't exist yet */ }
         fs.cpSync(builtinSiteDir, userSiteDir, { recursive: true });
-        console.log(`✅ Ejected "${site}" to ~/.bycli/clis/${site}/`);
+        console.log(`✅ Ejected "${site}" to ${userSiteDir}/`);
         console.log('You can now edit the adapter files. Changes take effect immediately.');
         console.log('Note: Official updates to this adapter will overwrite your changes.');
     });
@@ -2836,8 +2834,7 @@ cli({
         .argument('[site]', 'Site name (e.g. twitter, bilibili)')
         .option('--all', 'Reset all local overrides')
         .action(async (site, opts) => {
-        const os = await import('node:os');
-        const userClisDir = path.join(os.homedir(), '.bycli', 'clis');
+        const userClisDir = getUserClisDir();
         if (opts.all) {
             try {
                 const userEntries = await fs.promises.readdir(userClisDir, { withFileTypes: true });

package/dist/src/commanderAdapter.js

@@ -11,7 +11,7 @@
  */
 import { log } from './logger.js';
 import yaml from 'js-yaml';
-import { fullName, getRegistry } from './registry.js';
+import { fullName, getRegistry, hasBrowserCapability } from './registry.js';
 import { render as renderOutput } from './output.js';
 import { executeCommand, prepareCommandArgs } from './execution.js';
 import { commandHelpData, formatCommandHelpText, formatCommandListTerm, formatSiteCommandDescription, formatSiteHelpText, getRequestedHelpFormat, renderStructuredHelp, siteHelpData, } from './help.js';
@@ -48,7 +48,7 @@ export function registerCommandToProgram(siteCmd, cmd) {
         .option('-f, --format <fmt>', 'Output format: table, plain, json, yaml, md, csv', 'table')
         .option('--trace <mode>', 'Trace capture: off, on, retain-on-failure', 'off')
         .option('-v, --verbose', 'Debug output', false);
-    if (cmd.browser) {
+    if (hasBrowserCapability(cmd)) {
         subCmd
             .option('--window <mode>', 'Browser window mode: foreground or background')
             .option('--site-session <mode>', 'Adapter site session lifecycle: ephemeral or persistent')
@@ -108,9 +108,9 @@ export function registerCommandToProgram(siteCmd, cmd) {
                 prepared: true,
                 ...(typeof globals.profile === 'string' && globals.profile.trim() ? { profile: globals.profile.trim() } : {}),
                 ...(typeof optionsRecord.trace === 'string' && optionsRecord.trace !== 'off' ? { trace: optionsRecord.trace } : {}),
-                ...(cmd.browser && typeof optionsRecord.window === 'string' ? { windowMode: optionsRecord.window } : {}),
-                ...(cmd.browser && typeof optionsRecord.siteSession === 'string' ? { siteSession: optionsRecord.siteSession } : {}),
-                ...(cmd.browser && typeof optionsRecord.keepTab === 'string' ? { keepTab: optionsRecord.keepTab } : {}),
+                ...(hasBrowserCapability(cmd) && typeof optionsRecord.window === 'string' ? { windowMode: optionsRecord.window } : {}),
+                ...(hasBrowserCapability(cmd) && typeof optionsRecord.siteSession === 'string' ? { siteSession: optionsRecord.siteSession } : {}),
+                ...(hasBrowserCapability(cmd) && typeof optionsRecord.keepTab === 'string' ? { keepTab: optionsRecord.keepTab } : {}),
             });
             if (result === null || result === undefined) {
                 return;

package/dist/src/config-paths.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Resolvers for the byCLI user-data root and its well-known subdirectories.
+ *
+ * The root is `BYCLI_CONFIG_DIR` when set, else `~/.bycli`. These are FUNCTIONS,
+ * not module-level constants, on purpose: `BYCLI_CONFIG_DIR` is set dynamically
+ * (tests, the verify child sandbox in runner-port.ts) — a const captured at import
+ * time would freeze the wrong root and leak across tests. Always resolve on call.
+ *
+ * Existing duplicate idioms this consolidates: observation/artifact.ts, browser/profile.ts.
+ */
+export declare function getConfigDir(): string;
+/** User adapter root: `$CONFIG_DIR/clis`. Adapters live at `<clis>/<site>/<command>.js`. */
+export declare function getUserClisDir(): string;
+/** Per-site memory/recorder root: `$CONFIG_DIR/sites`. */
+export declare function getSitesDir(): string;
+/** A single site's directory: `$CONFIG_DIR/sites/<site>`. */
+export declare function getSiteDir(site: string): string;
+/** A site's recorder artifact dir: `$CONFIG_DIR/sites/<site>/recorder`. */
+export declare function getSiteRecorderDir(site: string): string;

package/dist/src/config-paths.js

@@ -0,0 +1,31 @@
+import * as os from 'node:os';
+import * as path from 'node:path';
+/**
+ * Resolvers for the byCLI user-data root and its well-known subdirectories.
+ *
+ * The root is `BYCLI_CONFIG_DIR` when set, else `~/.bycli`. These are FUNCTIONS,
+ * not module-level constants, on purpose: `BYCLI_CONFIG_DIR` is set dynamically
+ * (tests, the verify child sandbox in runner-port.ts) — a const captured at import
+ * time would freeze the wrong root and leak across tests. Always resolve on call.
+ *
+ * Existing duplicate idioms this consolidates: observation/artifact.ts, browser/profile.ts.
+ */
+export function getConfigDir() {
+    return process.env.BYCLI_CONFIG_DIR || path.join(os.homedir(), '.bycli');
+}
+/** User adapter root: `$CONFIG_DIR/clis`. Adapters live at `<clis>/<site>/<command>.js`. */
+export function getUserClisDir() {
+    return path.join(getConfigDir(), 'clis');
+}
+/** Per-site memory/recorder root: `$CONFIG_DIR/sites`. */
+export function getSitesDir() {
+    return path.join(getConfigDir(), 'sites');
+}
+/** A single site's directory: `$CONFIG_DIR/sites/<site>`. */
+export function getSiteDir(site) {
+    return path.join(getSitesDir(), site);
+}
+/** A site's recorder artifact dir: `$CONFIG_DIR/sites/<site>/recorder`. */
+export function getSiteRecorderDir(site) {
+    return path.join(getSiteDir(site), 'recorder');
+}

package/dist/src/daemon.js

@@ -26,9 +26,35 @@ import { EXIT_CODES } from './errors.js';
 import { log } from './logger.js';
 import { PKG_VERSION } from './version.js';
 import { DEFAULT_CONTEXT_ID } from './browser/profile.js';
+import { createAdapterDraft, saveAdapterSource, recoverInitTransactions } from './recorder/highlevel/init.js';
+import { verifyAdapter } from './recorder/highlevel/verify.js';
+import { defaultRunnerPort, setDefaultRunnerDaemonPort, setDefaultRunnerObservability, setDefaultRunnerTempGuard } from './recorder/runner/runner-port.js';
+import { createMetrics } from '@sovovs/bycli-recorder-core';
+import { createRecorderLogger } from './recorder/observability/logger.js';
+import { reapOrphanedVerifyRuns } from './recorder/runner/reap.js';
+import { resolveTempPolicy, resolveRunnerConfig, resolveTempCapacity } from './recorder/runner/config.js';
+import { defaultSessionKeyRegistry } from './recorder/runner/session-keys.js';
 import { recordExtensionVersion } from './update-check.js';
+import { EXTENSION_CAPABILITY_MISSING_ERROR_CODE, EXTENSION_CAPABILITY_MISSING_HTTP_STATUS, extensionCapabilityHint, missingRequiredExtensionCapability, normalizeExtensionCapabilities, } from './browser/extension-capabilities.js';
 import { buildCommandDispatchFailure, buildExtensionDisconnectFailure, getResponseCorsHeaders, } from './daemon-utils.js';
 const PORT = parseInt(process.env.BYCLI_DAEMON_PORT ?? String(DEFAULT_DAEMON_PORT), 10);
+// The verify runner (M6b) spawns child processes that connect back to THIS daemon for a
+// browser Page. Hand them our port (→ BYCLI_DAEMON_PORT in the child env) so the child's
+// Page reaches us, not a freshly-spawned daemon. Must run before the first /v1/verify
+// builds the default runner singleton.
+setDefaultRunnerDaemonPort(PORT);
+// ─── Observability (#1b · 09) ────────────────────────────────────────
+// daemon/runner-side structured logs + metrics (M8 only did dashboard-be). The metrics instance is
+// a process singleton, shared by reference into the runner port (#1c) so GET /metrics shows runner
+// counters too. LOG_LEVEL is read once at startup — the daemon has no ConfigPort, so no hot reload
+// here (that's a larger, separate milestone); a malformed value falls back to 'info'.
+const LOG_LEVELS = ['error', 'warn', 'info', 'debug'];
+const envLogLevel = process.env.LOG_LEVEL ?? '';
+const metrics = createMetrics();
+const logger = createRecorderLogger(LOG_LEVELS.includes(envLogLevel) ? envLogLevel : 'info');
+// Share these singletons with the verify runner (#1c) BEFORE the first defaultRunnerPort() use, so
+// runner counters surface on GET /metrics and runner logs share the daemon's level.
+setDefaultRunnerObservability(metrics, logger);
 const extensionProfiles = new Map();
 const pending = new Map();
 let commandResultUnknownCount = 0;
@@ -98,6 +124,7 @@ function registerExtensionConnection(ws, rawContextId) {
         ws,
         extensionVersion: current?.ws === ws ? current.extensionVersion : null,
         extensionCompatRange: current?.ws === ws ? current.extensionCompatRange : null,
+        extensionCapabilities: current?.ws === ws ? current.extensionCapabilities : [],
         lastSeenAt: Date.now(),
     };
     extensionProfiles.set(contextId, connection);
@@ -119,6 +146,7 @@ function unregisterExtensionConnection(ws) {
             });
             if (failure.countAsCommandResultUnknown) {
                 commandResultUnknownCount++;
+                metrics.inc('daemon_command_result_unknown_total'); // #1b: structured metric alongside the /status field
                 log.warn(`[daemon] Command result unknown after extension disconnect (id=${id}, action=${p.action}, context=${contextId})`);
             }
             p.reject(new DaemonCommandFailure(failure.message, failure.errorCode, failure.errorHint, failure.status));
@@ -150,6 +178,11 @@ function readBody(req) {
     });
 }
 function jsonResponse(res, status, data, extraHeaders) {
+    // Stash any errorCode for the request-completion metrics choke point (#1b), so handlers don't
+    // each have to wire it through. Only the bounded ErrorCode enum reaches a label/log field.
+    const ec = data?.errorCode;
+    if (typeof ec === 'string')
+        res.__errorCode = ec;
     res.writeHead(status, { 'Content-Type': 'application/json', ...extraHeaders });
     res.end(JSON.stringify(data));
 }
@@ -174,6 +207,32 @@ async function handleRequest(req, res) {
     }
     const url = req.url ?? '/';
     const pathname = url.split('?')[0];
+    // Request-completion metrics choke point (#1b · 09): one place records type/status/errorCode +
+    // latency, no per-handler scatter. Only the high-level surface (/v1/*) and the /command bridge are
+    // counted; the dynamic /v1/requests/{id} segment collapses to a bounded route template so the
+    // `operation` label can't grow unboundedly. /v1/* operations also get a structured log line
+    // (low volume, the recording ops); /command is counted but not logged (per-command WS bridge is
+    // high volume). Never logs headers/token/body — only operation/status/errorCode/durationMs.
+    const reqStarted = Date.now();
+    res.on('finish', () => {
+        let operation = null;
+        if (pathname.startsWith('/v1/requests/'))
+            operation = 'v1.requests';
+        else if (pathname.startsWith('/v1/'))
+            operation = `v1${pathname.slice(3).replace(/\//g, '.')}`; // /v1/init → v1.init
+        else if (pathname === '/command')
+            operation = 'command';
+        if (!operation)
+            return;
+        const status = res.statusCode < 400 ? 'ok' : 'failed';
+        const errorCode = res.__errorCode;
+        const durationMs = Date.now() - reqStarted;
+        metrics.inc('daemon_requests_total', { operation, status, errorCode });
+        if (operation === 'v1.verify')
+            metrics.observe('daemon_verify_duration_ms', durationMs);
+        if (operation.startsWith('v1'))
+            logger.info(`daemon.${operation}`, { status, errorCode, durationMs });
+    });
     // Health-check endpoint — no X-byCLI header required.
     // Used by the extension to silently probe daemon reachability before
     // attempting a WebSocket connection (avoids uncatchable ERR_CONNECTION_REFUSED).
@@ -193,6 +252,102 @@ async function handleRequest(req, res) {
         jsonResponse(res, 403, { ok: false, error: 'Forbidden: missing X-byCLI header' });
         return;
     }
+    // High-level init (M5b · A'): daemon hosts the FS-writing init capability; the
+    // logic lives in the main-repo init module (createAdapterDraft). dashboard-be
+    // forwards here rather than writing main-repo adapter paths itself. Synchronous
+    // (init is a short FS op, not a long-running runner); requestId/async is deferred.
+    if (req.method === 'POST' && pathname === '/v1/init') {
+        try {
+            const body = JSON.parse(await readBody(req));
+            if (typeof body.name !== 'string' || !body.name) {
+                jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: 'name required' });
+                return;
+            }
+            const result = createAdapterDraft(body);
+            if (!result.ok) {
+                // init failures are all client-fixable 400s (validation_failed / responsible_use_required).
+                jsonResponse(res, 400, { ok: false, errorCode: result.errorCode, error: result.reason });
+                return;
+            }
+            jsonResponse(res, 200, { ok: true, data: { report: result.report, dryRun: result.dryRun, generatedSource: result.generatedSource } });
+        }
+        catch (err) {
+            jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: err instanceof Error ? err.message : String(err) });
+        }
+        return;
+    }
+    // N4: save a reviewed, full LLM-generated adapter source to clis/ (verify-then-save flow).
+    if (req.method === 'POST' && pathname === '/v1/save-adapter') {
+        try {
+            const body = JSON.parse(await readBody(req));
+            if (typeof body.name !== 'string' || !body.name || typeof body.source !== 'string' || !body.source) {
+                jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: 'name and source required' });
+                return;
+            }
+            const result = saveAdapterSource(body);
+            if (!result.ok) {
+                jsonResponse(res, 400, { ok: false, errorCode: result.errorCode, error: result.reason });
+                return;
+            }
+            jsonResponse(res, 200, { ok: true, data: { adapterPath: result.adapterPath, reportPath: result.reportPath } });
+        }
+        catch (err) {
+            jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: err instanceof Error ? err.message : String(err) });
+        }
+        return;
+    }
+    // High-level verify (A'): interface + delegation seam. The adapter JS runs in the
+    // M6 child-process runner (08) — verifyAdapter delegates to the real spawn-based
+    // RunnerPort (defaultRunnerPort), so runner_protocol_error now signals an actual
+    // runner fault, not "not implemented". The evidence HMAC is keyed by a per-session salt
+    // held only in daemon memory (M7a · 04:111): be forwards the non-secret sessionId, the
+    // daemon mints + holds the salt, and it never crosses the wire.
+    if (req.method === 'POST' && pathname === '/v1/verify') {
+        try {
+            const body = JSON.parse(await readBody(req));
+            if (typeof body.name !== 'string' || !body.name) {
+                jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: 'name required' });
+                return;
+            }
+            const sessionHmacKey = defaultSessionKeyRegistry().keyFor(body.sessionId);
+            const result = await verifyAdapter(body, sessionHmacKey);
+            if (!result.ok) {
+                const status = result.errorCode === 'validation_failed' ? 400
+                    : result.errorCode === 'queue_full' ? 429 // 03: queue/concurrency exceeded
+                        : 500;
+                // requestId/sessionId correlation the choke point (res-only) can't see (09:89).
+                logger.warn('daemon.verify', { sessionId: body.sessionId, status: 'failed', errorCode: result.errorCode });
+                jsonResponse(res, status, { ok: false, errorCode: result.errorCode, error: result.reason });
+                return;
+            }
+            logger.info('daemon.verify', { requestId: result.requestId, sessionId: body.sessionId, stage: 'accepted' });
+            jsonResponse(res, 200, { ok: true, data: { requestId: result.requestId } });
+        }
+        catch (err) {
+            jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: err instanceof Error ? err.message : String(err) });
+        }
+        return;
+    }
+    // High-level request status (M6 · ADR-0007): be polls verify status here. The runner
+    // registry is keyed by the canonical requestId (be ↔ daemon ↔ runner share one id);
+    // returns summary-only VerifySummary (raw seed/stdout/stderr/trace path never included).
+    if (req.method === 'GET' && pathname.startsWith('/v1/requests/')) {
+        const requestId = decodeURIComponent(pathname.slice('/v1/requests/'.length));
+        if (!requestId) {
+            jsonResponse(res, 400, { ok: false, errorCode: 'validation_failed', error: 'requestId required' });
+            return;
+        }
+        const runStatus = defaultRunnerPort().getRunStatus(requestId);
+        if (!runStatus) {
+            jsonResponse(res, 404, { ok: false, errorCode: 'request_not_found', error: 'unknown requestId' });
+            return;
+        }
+        // RunStatus (queued|running|succeeded|failed|timeout|cancelled) maps 1:1 to request status;
+        // summary is null while queued/running, a VerifySummary once terminal (M6c adds queued).
+        logger.debug('daemon.requests', { requestId, status: runStatus.status });
+        jsonResponse(res, 200, { ok: true, data: { requestId, status: runStatus.status, result: runStatus.summary } });
+        return;
+    }
     if (req.method === 'GET' && pathname === '/status') {
         const uptime = process.uptime();
         const mem = process.memoryUsage();
@@ -204,6 +359,7 @@ async function handleRequest(req, res) {
             extensionConnected: true,
             extensionVersion: profile.extensionVersion ?? undefined,
             extensionCompatRange: profile.extensionCompatRange ?? undefined,
+            extensionCapabilities: profile.extensionCapabilities,
             pending: [...pending.values()].filter((entry) => entry.contextId === profile.contextId).length,
             lastSeenAt: profile.lastSeenAt,
         }));
@@ -215,6 +371,7 @@ async function handleRequest(req, res) {
             extensionConnected: !!route.connection,
             extensionVersion: route.connection?.extensionVersion ?? undefined,
             extensionCompatRange: route.connection?.extensionCompatRange ?? undefined,
+            extensionCapabilities: route.connection?.extensionCapabilities,
             contextId: route.connection?.contextId ?? requestedContextId,
             profileRequired: route.errorCode === 'profile_required',
             profileDisconnected: route.errorCode === 'profile_disconnected',
@@ -226,6 +383,13 @@ async function handleRequest(req, res) {
         });
         return;
     }
+    // Metrics scrape (#1b · 09): loopback diagnostic, same X-byCLI posture as /status (no token).
+    // The counter/histogram registry is pure data in recorder-core; this endpoint (http-bound) stays
+    // in the daemon transport layer. Values are non-sensitive enums/counts only (09).
+    if (req.method === 'GET' && pathname === '/metrics') {
+        jsonResponse(res, 200, { ok: true, ...metrics.snapshot() });
+        return;
+    }
     if (req.method === 'GET' && pathname === '/logs') {
         const params = new URL(url, `http://localhost:${PORT}`).searchParams;
         const level = params.get('level');
@@ -263,6 +427,17 @@ async function handleRequest(req, res) {
                 });
                 return;
             }
+            const requiredCapability = missingRequiredExtensionCapability(body, route.connection.extensionCapabilities);
+            if (requiredCapability) {
+                jsonResponse(res, EXTENSION_CAPABILITY_MISSING_HTTP_STATUS, {
+                    id: body.id,
+                    ok: false,
+                    errorCode: EXTENSION_CAPABILITY_MISSING_ERROR_CODE,
+                    error: `Connected Browser Bridge does not advertise ${requiredCapability}.`,
+                    errorHint: extensionCapabilityHint(requiredCapability),
+                });
+                return;
+            }
             const timeoutMs = typeof body.timeout === 'number' && body.timeout > 0
                 ? body.timeout * 1000
                 : 120000;
@@ -369,6 +544,7 @@ wss.on('connection', (ws) => {
                 const connection = registerExtensionConnection(ws, msg.contextId);
                 connection.extensionVersion = typeof msg.version === 'string' ? msg.version : null;
                 connection.extensionCompatRange = typeof msg.compatRange === 'string' ? msg.compatRange : null;
+                connection.extensionCapabilities = normalizeExtensionCapabilities(msg.capabilities);
                 connection.lastSeenAt = Date.now();
                 if (connection.extensionVersion)
                     recordExtensionVersion(connection.extensionVersion);
@@ -411,6 +587,86 @@ wss.on('connection', (ws) => {
 // ─── Start ───────────────────────────────────────────────────────────
 httpServer.listen(PORT, '127.0.0.1', () => {
     log.info(`[daemon] Listening on http://127.0.0.1:${PORT}`);
+    // Temp-store reap policy (M7b · 09:27-29). Resolved once at startup; out-of-range env → throws,
+    // but we keep the daemon alive by falling back to the (validated-elsewhere) defaults on error.
+    let tempPolicy;
+    try {
+        tempPolicy = resolveTempPolicy();
+    }
+    catch (err) {
+        log.warn(`[daemon] temp policy config invalid, using defaults: ${err instanceof Error ? err.message : String(err)}`);
+        tempPolicy = { tempTtlMs: 3_600_000, startupReapMaxAgeMs: 86_400_000, orphanKillGraceMs: 1_500 };
+    }
+    // Age-reap safety floor (08 / M7b): a verify cannot legitimately outlive timeoutMs + killGraceMs,
+    // so the age threshold must never drop below it — otherwise a short RECORDER_TEMP_TTL_MS (min 60s)
+    // would let the sweep kill a still-running verify (timeoutMs reaches 600s). Fall back to the
+    // absolute config ceiling (max timeoutMs + max killGraceMs) if runner config is unreadable.
+    let minLeakAgeMs = 600_000 + 30_000;
+    try {
+        const rc = resolveRunnerConfig();
+        minLeakAgeMs = rc.timeoutMs + rc.killGraceMs;
+    }
+    catch { /* keep the absolute ceiling (safest, highest floor) */ }
+    // #1d temp-store capacity guard: the runner refuses a new verify (temp_store_full) past the high
+    // watermark rather than risk filling the disk. Resolved at startup (temp root is restart-only,
+    // 09:182); bad env falls back to defaults (consistent with temp policy above). Registered BEFORE the
+    // first defaultRunnerPort() use (no request is served until after this listen callback returns). The
+    // on-pressure sweep reuses the same age-bounded reap as the periodic sweep (never kills a live verify).
+    let tempCapacity;
+    try {
+        tempCapacity = resolveTempCapacity();
+    }
+    catch (err) {
+        log.warn(`[daemon] temp capacity config invalid, using defaults: ${err instanceof Error ? err.message : String(err)}`);
+        tempCapacity = resolveTempCapacity({}); // empty env → validated defaults
+    }
+    setDefaultRunnerTempGuard(tempCapacity, () => {
+        reapOrphanedVerifyRuns({ log: (m) => log.info(m), maxAgeMs: tempPolicy.tempTtlMs, minLeakAgeMs, graceMs: tempPolicy.orphanKillGraceMs });
+    });
+    // Startup reap (08:37): clean up verify temp dirs orphaned by a previously-crashed daemon
+    // (ownerPid-dead), plus any dir older than the startup age backstop (M7b leak sweep). A live
+    // sibling's in-flight verify (young + owner alive, or within the hard-deadline floor) is never touched.
+    try {
+        const r = reapOrphanedVerifyRuns({ log: (m) => log.info(m), maxAgeMs: tempPolicy.startupReapMaxAgeMs, minLeakAgeMs, graceMs: tempPolicy.orphanKillGraceMs });
+        // #1c · 09 startup reap count (orphan runners killed, temp dirs swept)
+        if (r.orphans)
+            metrics.inc('startup_reap_orphans_total', undefined, r.orphans);
+        if (r.killed)
+            metrics.inc('startup_reap_killed_total', undefined, r.killed);
+        if (r.deleted)
+            metrics.inc('startup_reap_deleted_total', undefined, r.deleted);
+    }
+    catch (err) {
+        log.warn(`[daemon] verify startup reap failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    // Periodic TTL sweep (M7b): while the daemon runs, reap dirs older than the temp TTL — but never
+    // below the run hard-deadline floor (minLeakAgeMs), so an aggressive TTL can't kill a live verify.
+    // Unref'd so it never keeps the process alive on its own.
+    const sweep = setInterval(() => {
+        try {
+            const r = reapOrphanedVerifyRuns({ log: (m) => log.info(m), maxAgeMs: tempPolicy.tempTtlMs, minLeakAgeMs, graceMs: tempPolicy.orphanKillGraceMs });
+            if (r.killed)
+                metrics.inc('temp_sweep_killed_total', undefined, r.killed);
+            if (r.deleted)
+                metrics.inc('temp_sweep_deleted_total', undefined, r.deleted);
+            // Drop salts for abandoned sessions (M7a TTL backstop; daemon restart already rotates all).
+            const dropped = defaultSessionKeyRegistry().sweepExpired();
+            if (dropped)
+                metrics.inc('session_keys_dropped_total', undefined, dropped);
+        }
+        catch (err) {
+            log.warn(`[daemon] verify temp sweep failed: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }, tempPolicy.tempTtlMs);
+    sweep.unref?.();
+    // Init write-transaction crash recovery (07:106-117): resolve any adapter draft interrupted
+    // mid-write by a previous crash (roll-forward marker / quarantine unprovenanced / roll back).
+    try {
+        recoverInitTransactions({ log: (m) => log.info(m) });
+    }
+    catch (err) {
+        log.warn(`[daemon] init startup recovery failed: ${err instanceof Error ? err.message : String(err)}`);
+    }
 });
 httpServer.on('error', (err) => {
     if (err.code === 'EADDRINUSE') {

package/dist/src/discovery.d.ts

@@ -7,11 +7,13 @@
  *    when their command is executed.
  * 2. FALLBACK (filesystem scan): Traditional runtime discovery for development.
  */
-/** User runtime directory: ~/.bycli */
+/** User runtime directory: BYCLI_CONFIG_DIR or ~/.bycli.
+ * Resolved once at module load; the entry process fixes BYCLI_CONFIG_DIR before import. */
 export declare const USER_BYCLI_DIR: string;
-/** User CLIs directory: ~/.bycli/clis */
+/** User CLIs directory: <config>/clis */
 export declare const USER_CLIS_DIR: string;
-/** Plugins directory: ~/.bycli/plugins/ */
+/** Plugins directory: <config>/plugins/ (plugins are out of scope for the clis/sites
+ * relocation; kept as a const that many plugin.ts/tests consumers rely on). */
 export declare const PLUGINS_DIR: string;
 /**
  * Ensure ~/.bycli/node_modules/@sovovs/bycli symlink exists so that
@@ -35,6 +37,11 @@ export declare function ensureUserAdapters(): Promise<void>;
  * Uses pre-compiled manifest when available for instant startup.
  */
 export declare function discoverClis(...dirs: string[]): Promise<void>;
+/**
+ * Fast-path: register commands from pre-compiled manifest.
+ * TS modules are deferred — loaded lazily on first execution.
+ */
+export declare function loadFromManifest(manifestPath: string, clisDir: string): Promise<boolean>;
 /**
  * Discover and register plugins from ~/.bycli/plugins/.
  * Each subdirectory is treated as a plugin (site = directory name).